This edition tracks major developments in cybercrime enforcement, ransomware prosecutions, infrastructure exploitation and UK cyber resilience. Highlights include more than 5,800 arrests in INTERPOL’s latest fraud operation, new Ryuk and BlackCat cases, the widening FortiBleed credential campaign, OpenPLC vulnerabilities, reported AI-enabled ransomware activity and plans for an AI-supported national Cyber Shield.

Canvas breach investigations affecting universities, ransomware disruption at West Pharmaceutical and Foxconn, active exploitation of a critical cPanel vulnerability, and Europol’s latest cybercrime assessment headline this 48-hour roundup. Coverage also examines AI-assisted exploitation, leaked ransomware operator data, industrial control system security advisories, and evolving policy guidance on cyber resilience and frontier artificial intelligence.

Grafana confirmed a breach after cybercriminal exposure claims, while researchers tracked Telegram-based iPhone unlocking services tied to stolen devices. Investigators also examined active exploitation of a critical NGINX vulnerability, cloned Shai-Hulud malware campaigns and INTERPOL’s Operation Ramz arrests across the MENA region. Policy discussions focused on AI-assisted vulnerability discovery and regulatory expectations surrounding automated cyber risk analysis in financial sectors.

Investigations span exposed property records in Tasmania, stolen Canvas student data, and a breach affecting Asian football organisations. Authorities warn of cyber-enabled cargo theft, while researchers link Shadow-Earth-053 to infrastructure targeting. Active cPanel exploitation and OAuth abuse campaigns expand attack surfaces, as new guidance highlights risks from autonomous AI systems and investigative challenges in evidence attribution.

Europol fraud and Black Axe actions, Signal phishing targeting German officials, Singapore contractor data exposure, Winona County ransomware leaks, Itron and Medtronic network intrusions, active cPanel exploitation, malicious SAP npm packages, UK breach survey findings, and agentic AI security guidance shape this DFM 48-hour roundup for investigators focused on evidence, attribution, audit trails, and cross-platform correlation readiness.